---
title: "Use automation to combat threats"
slug: "use-automation-to-combat-threats"
updated: 2026-09-09T16:09:29Z
published: 2026-09-09T16:09:29Z
canonical: "docs.redcanary.com/use-automation-to-combat-threats"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use Automation to Combat Threats

[Automation](/doc/docs/automation) is the key to quickly remediating threats and minimizing your time to remediation. You can configure automation playbooks to be triggered by several events in the life cycle of a confirmed threat:

- When a threat is published
- When a threat is marked as remediated
- When a threat is marked as not remediated
- When a threat is acknowledged

## Respond to a threat

You can configure an automation playbook to execute during a threat's life cycle.

1. From the navigation menu, click **Automation**.
2. Click **Configure new trigger** and select **When a Threat is published**.
3. Customize the trigger to meet your needs.
4. Associate one or more playbooks to the trigger.

## What automation actions affect the state of threats?

A number of automation actions can affect the state of a threat in Zscaler MDR. These include,

- Marking a threat as acknowledged
- Marking a threat as not remediated (with a specific reason)
- Marking a threat as remediated

You can find the complete list of actions in Zscaler MDR.

## Notifying your incident response team when a threat is confirmed

![Threat_severity_high_medium_new.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/11409820971671.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A44%3A52Z&se=2026-10-27T03%3A44%3A52Z&sr=c&sp=r&sig=sfR8xqTs5Nu%2F7MFP0nw1ZRkgZOSMmdb5aZH6n%2FoNDF0%3D)

Notify your team whenever a threat with a specific severity is published, by triggering playbooks that:

- Create a ticket in your incident management system with the **Webhook or API** action.
- Email an incident response mailing list with the **Send Email** action.
- Post a message in a Slack/Teams channel with the **Send Slack Message** or **Send Microsoft Teams Message** action.
- Trigger a PagerDuty incident for your security response team using the **Create PagerDuty Incident** action.
- Call a phone tree using the **Call Phone Numbers** action.

## Isolate and remediate workstations affected by malicious software

![Threat_workstation.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/11411425519255.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A44%3A52Z&se=2026-10-27T03%3A44%3A52Z&sr=c&sp=r&sig=sfR8xqTs5Nu%2F7MFP0nw1ZRkgZOSMmdb5aZH6n%2FoNDF0%3D)

Activate network isolation / containment for workstation (non-server) endpoints that are affected by malicious software detections, by triggering playbooks that:

- Enqueue endpoint isolation using the **Isolate the Endpoint** action.
- Disable network communications with a device management system triggered with the **Webhook or API** action.
- Record a number of forensics artifacts using the **Collect forensics** action.
- Remediate infections using the **Kill Processes (IOC)**, **Delete/Capture Files (IOC)**, etc., actions.